[coreboot-gerrit] Change in coreboot[master]: security: Add common boot media write protection

[Patrick Rudolph (Code Review)]

Patrick Rudolph has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/32704 )

Change subject: security: Add common boot media write protection
......................................................................

Patch Set 10:
> Patch Set 10:
> > That's because platform code decides when to lock down SPI flash and there's no gurantee it will happen in BS_POST_DEVICE. Locking it early here will brick the MRC cache...
>
> But the MRC cache is also common code? So just pick the latest it can happen from there (looks like that's OS_RESUME_CHECK)? Sounds like this is something we should try to standardize now if it hasn't been before.

that doesn't work because on Intel the spibar is locked before DEV_INIT.